macOS High Sierra: Anyone can login as “root” with empty password

Post by sounds » Tue, Nov 28, 2017, 9:17 PM UTC

kristofferR wrote: post #148

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

I really disagree - this needs to be reported as much as possible publicly to create a huge thunderstorm of negative publicity for Apple. This isn't the first extremely serious and dumb High Sierra password bug this year [1] [2], and unless Apple is severely hurt by it, so they're forced to change, it won't be the last. High Sierra is full of bugs and seemingly not just annoying bugs, but also security bugs. Let's ho…

Post by mikeash » Tue, Nov 28, 2017, 9:17 PM UTC

overcast wrote: post #276

mikeash wrote: post #241

Earlier quoted context omitted.

If that were true, then the security community wouldn't have spent years fighting about whether responsible disclosure was the right approach. That's for people who actually understand this stuff. It's unreasonable to expect an outsider to derive it all on their own from first principles.

So someone stumbles upon a lost cache of chemical weapons. Rather than reporting to the authorities, they post its location on Twitter. That's called just using your brain.

Post by notanai » Tue, Nov 28, 2017, 9:17 PM UTC

LeoPanthera wrote: post #142

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

It's not local if you have Remote Desktop enabled. Works over that too. From there you can enable ssh and all bets are off.

Post by overcast » Tue, Nov 28, 2017, 9:17 PM UTC

fixermark wrote: post #174

overcast wrote: post #33

Excuse my language, but this was a dick move to post this publicly, especially on Twitter. Go through private bug channels properly for something as serious as this. Of course doing it that way doesn't give you your 15 minutes of interweb fame.

When I put it into my personal malice / ignorance balance, it weighs out to the likelihood that the discloser isn't plugged in enough to the infosec scene to be aware that there are already best practices for this kind of disclosure. It's a big world out there, especially nowadays. And nothing I've seen in recent history suggests to me the average user knows or cares about infosec concerns beyond basic hindsight unde…

Post by shavingspiders » Tue, Nov 28, 2017, 9:18 PM UTC

mithr wrote: post #273

devindotcom wrote: post #215

Earlier quoted context omitted.

we've seen it only in 10.13.1 (17B48) so far

It also works on 10.13 (17A365)